Remote secure boot verification service for secure deployment of virtual machines

An information handling system, comprising:

• a central processing unit (CPU);
• and a memory, including processor executable instructions that, when executed by the CPU, cause the system to perform virtual machine authentication operations, wherein the virtual machine authentication operations include:
• detecting, by a lightweight secure operating system (LSOS) running on an information handling system, a virtual machine launch (VML) request associated with an unconfirmed virtual machine (VM) and a hypervisor, wherein the LSOS resides on an original equipment manufacturer (OEM)-protected nonvolatile memory express (NVMe) partition and is communicatively coupled to a VM deployment/verification cloud service server;
• activating, by the LSOS, a digital certificate checker (DCC) in response to detecting the VML request;
• requesting, by the DCC, a VM signing (VMS) certificate from the cloud service server, wherein the VMS certificate is stored in an authenticated variable store;
• receiving the VMS certificate and forwarding it to a certificate store of the hypervisor;
• executing, by the hypervisor, Secure Boot authentication of the unconfirmed VM using the VMS certificate;
• responsive to successful authentication, permitting the VM to launch and deleting the VMS certificate from the certificate store;
• and responsive to failed authentication, terminating the unconfirmed VM and copying, by the LSOS, a suspect certificate to a prohibited database (DBX) variable store of the cloud service server to prevent future unauthorized VM launches.

A method for authenticating virtual machines, the method comprising:

• detecting, by a lightweight secure operating system (LSOS) running on an information handling system, a virtual machine launch (VML) request associated with an unconfirmed virtual machine (VM) and a hypervisor running on the information handling system, wherein the LSOS resides on an original equipment manufacturer (OEM)-protected nonvolatile memory express (NVMe) partition and is communicatively coupled to a VM deployment/verification cloud service server via a secure connection;
• activating, by the LSOS, a digital certificate checker (DCC) in response to detecting the VML request;
• requesting, by the DCC, a VM signing (VMS) certificate from the VM deployment/verification cloud service server, wherein the VMS certificate is stored in an authenticated variable store of the cloud service server;
• receiving, from the VM deployment/verification cloud service server, the VMS certificate;
• forwarding, by the DCC, the VMS certificate to a certificate store of the hypervisor;
• executing, by the hypervisor, a Secure Boot authentication of the unconfirmed, VM using the VMS certificate;
• responsive to successful authentication of the unconfirmed VM, permitting the unconfirmed VM to launch and deleting the VMS certificate from the certificate store of the hypervisor;
• and
• responsive to receiving an alert from the hypervisor indicating a failed authentication associated with the unconfirmed VM, performing one or more termination operations, wherein the one or more termination operations include:
• terminating the unconfirmed VM to prevent the unconfirmed VM from running under the hypervisor;
• and
• copying, by the LSOS, a suspect certificate associated with the unconfirmed VM to a prohibited database (DBX) variable store of the VM deployment/verification cloud service server to prevent future unauthorized VM launches using the suspect certificate.